Avast Can't Find Multiple Trojan Horse Files

lpeter40 · Dec 7, 2009

I received multiple warnings from Avast that I had trojan horses but it could not locate the files. Messages I received were as follows:
AVAST!: The system cannot find the file specified. Cannot process
C:\Program files\Tall EMU\Online Armor\OAWatch.dll file
Malware name: Win32elf-MZG[Trojan Horse]
Type: Trojan Horse
VPS version: 091203-0, 12/03/2009

Another file showed the similar message but included the following:
C:\Progra~1\Spybot~1\SDHelper.dll
Name: Win32elf-MZG[TRJ]

I also noticed that MS Security Center tells me that I'm running Online Armor, but when I tried to turn it off, I could not find it on the bottom right corner of my screen where all the other icons reside (e.g., Avast). So i went to delete Online Armor from the start menu after finding it among my programs. i deleted what appeared to be left of it and restarted my computer. However, MS Security Center still shows that my Online Armor firewall is still "On" even though it's no longer on my computer.

I ran thru all of the Malware processes required by this forum before filing the attached. Note that I have not received any further malware warnings recently from Avast.

Also note that no file is attached for SuperAntiSpyware. It did not find any infected files. Thank you for the help!

chaslang · Dec 9, 2009

Welcome to Major Geeks!

You have been bitten by a bunch of false detection in a recent Avast update. The false detections have been fixed in a subsequent update. Make sure you have updated.

Online Armor was your firewall and you should not have deleted/uninstalled it. Also SDHelper.dll is just part of Spybot.

Your logs are clean other than what has already been remove. You just need to update Sun Java as stated in the READ & RUN ME.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 6 of the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

lpeter40 · Dec 10, 2009

Thanks for the help! I'm still a bit confused by the status of Online Armor. Security Center shows it is still running as my firewall though I thought I successfully uninstalled it earlier. When I do a search I see folders for Online Armor on other user accounts on my computer but not the admin account. I don't see Online Armor when I go to Add/Delete Programs in the Control Panel. I downloaded another copy of it. Should I simply run it and therefore potentially overwrite my current version if it still exists? Thx!

chaslang · Dec 11, 2009

Yes it would be best to reinstall since it is most likely broken.

lpeter40 · Dec 14, 2009

Thanks for the help!

chaslang · Dec 16, 2009

You're welcome. Surf safely!

Log in or Sign up

Avast Can't Find Multiple Trojan Horse Files

lpeter40 Private E-2

Attached Files:

combofix-log.txt

mbam-log-2009-12-06 (20-07-35).txt

MGlogs.zip

RootRepeal-report.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

lpeter40 Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

lpeter40 Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member